StegGuard Demo

Seven sample files, one hidden sentence

We ran StegGuard 0.3.0 over 7 sample files on 2026-10-29. It flagged 4 of them. Every number and line of output below comes from that run, and the files are in stegguard/samples so you can run it yourself.

On this page

One file, start to finish
All seven files
The full report
What we left out

One file, start to finish

Here is line 4 of release_notes.md as an editor or a GitHub diff shows it.

release_notes.md, line 4

- Faster startup on Windows.296 zero-width

A normal changelog bullet.296 zero-width characters follow the full stop, one per bit.

Detect

stegguard detect

$ stegguard detect release_notes.md
  • 296 zero-width characters found
  • 2 distinct type(s) used
  ⚠ 1/1 file(s) flagged

Decode

Zero-width space is a 0, zero-width non-joiner is a 1, eight to a byte.

stegguard decode (excerpt)

$ stegguard decode release_notes.md
  "zero_width": {
    "decoded": "rotate the staging keys before friday",
    "confidence": 0.9,
    "occurrences": 296
  },

Sanitize

The clean copy goes to release_notes.sanitized.md. The original is not touched.

stegguard sanitize (excerpt)

$ stegguard sanitize release_notes.md
  "zero_width_removed": 296,
  "bidi_removed": 0,
  "homoglyphs_replaced": 0,
  "original_preserved": true

All seven files

File	Result	What's in it
`calculator_2.py`	critical	3,340 zero-width non-joiners after the last comment. All the same character, so there is no message in them, but they are still 3,340 characters nobody can see.
`release_notes.md`	critical	296 zero-width characters at the end of one bullet. They spell a sentence; the walkthrough above decodes it.
`nothing_hidden.py`	medium	Six zero-width characters inside a comment that claims nothing is hidden. Too few bits to make a single byte.
`sample.snowed_2.txt`	low	Runs of trailing whitespace on all three lines (50, 43 and 35 characters), the pattern SNOW-style hiding leaves.
`calculator.py`	clean	Control file. The same calculator without the payload.
`example.txt`	clean	Control file. Plain text.
`hello.py`	clean	Control file. Two lines of ordinary Python.

The full report

This is the report the command below wrote, unchanged. It is one self-contained HTML file: no scripts or fonts from anywhere else, so it opens the same on an air-gapped machine.

shell

$ stegguard detect samples -r --html report.html

Open the report in its own tab